Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes

Three of the 622 CVEs for which Microsoft issued patches this week are zero-days; there are more than 60 critical vulnerabilities.

July 14, 2026

When Microsoft vice president of engineering Tom Gallagher warned in May that the company's monthly patch releases could soon grow larger because of AI-driven vulnerability discovery, few likely expected the numbers would surpass 600 just two months later.

But with fixes for 622 unique CVEs, Microsoft’s July 2026 Patch Tuesday update is the largest by far in the program's history and offers a preview of the growing prioritization challenges organizations face as AI dramatically increases the volume of flaws requiring attention.

July's update contains fixes for three zero-day vulnerabilities, two of which attackers are already exploiting and one that's publicly known but remains unexploited. The patch update also includes fixes for more than five dozen critical vulnerabilities, many of which Microsoft identified as flaws that attackers are more likely to exploit. The total includes 416 vulnerabilities in Windows, 82 each in Office and Office 2016, 46 in Edge, 27 in Microsoft Developer Tools, and 17 in SharePoint Server.